Skip to main content
scerazy
scerazy
Visitor III
October 16, 2019
Question

Any luck with wildcard * from 6.2.2

  • October 16, 2019
  • 1 reply
  • 9202 views

I was hoping that 10 years later Fortinet eventually managed to pull off the logical URL access with wildcards

So was really excited about 6.2.2. Upgraded today (it did actually fixed constantly broken SSL connections), but the URL wildcard seems to not work

 

All I need is a bunch of URLs that I allow all users to access, big or small, authenticated or not. Just everybody that hits the firewall.

One being ie *.abtutor.com

Simple rule from Lan to Internet, source any, destination this very FDQN address

 

Logged on workstation as local user (hence no SSO to kick in), expoected to be nicely presented with AB Tutor site

Instead all I got is Fortigate login page!

 

Anybody had any luck?

 

Seb

    1 reply

    AtiT
    AtiT
    New Member
    October 16, 2019

    Hello,

    The wildcard is working for me. This is something to do with DNS resolving as per docummentation:

    When the wildcard FQDN gets the resolved IP addresses, FortiOS loads the addresses into the firewall policy for traffic matching.

     

    I have a FortiGate in mode that the FortiGate provides DNS for clients on its local interfaces.

    Unfortunately this feature is not docummented as it should be. Should the FGT be the source DNS for the clients or the clients can access external DNS server directly and the FGT will update is FQDN table according to the DNS server response? How many IP addresses can be in the buffer (cached) for one wildcard FQDN?

    Why Fortinet does not give all the information about the features? ... and not only about the features.

    It is very hard to get some more detailed information about anything.

     

    If you want to see something like FortiGate 6.2.2 admin guide or handbook you will not find it. Only cookbook for 6.2.0. Why the admin guide/handbook does not exists anymore?

    Where is the 6.2.2 cookbook containing information about the wildcard policy object?

     

    Check the last Handbook for 6.0.6 FortiOS version. Very nice Hadbook where you can find information about the firewall objects.

    Nobody wants the handbook anymore?

    I cannot see the 6.2.2 handbook if some exists on the docs.fortinet.com.

     

    This is very sad :(

     

    boneyard
    boneyard
    Valued Contributor
    December 7, 2019

    wildcard will never work on firewall policies for other then HTTP traffic (where it will work with a webfilter profile).

     

    think about it

     

    a regular layer 3 request doesn't care about a hostname. it requests an IP address. so there you already have a problem.

     

    now for regular DNS entries (A record, CNAME ...) you can create the FQDN object, which looks up the DNS entry and saves that. so on the layer 3 it still is an IP address which is compared by the FortiGate.

     

    this isnt a perfect solution either, specially when you have DNS entries which differ in regions or use internal DNS which your FortiGate can't reach.

     

    but *.something.org isn't something you can lookup, the wildcard can be every word and possible go down levels i.e. host.domain.domain.something.org. a DNS server isn't going to give you all possible IP addresses when you request *.

     

    so you are stuck here and this will never be possible. they might be able to do some tricks with looking at all DNS requests and actively add those, but that will only work if the fortigate sees the dns request.

    scerazy
    scerazyAuthor
    Visitor III
    December 9, 2019

    wildcards *.something.??? work fine

    Ofcourse that is not magic, they are simply dynamic DNS entries

     

    But for simple sites it does work OK

     

    My original query was due to misconfiguartion !

    Terms & ConditionsAccessibility statement